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Status of Claims 



Claims 1-9 and 11-65 stand finally rejected and are on appeal. Claim 10 has previously 
been canceled and is not on appeal. 
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Grounds of Rejection to be Reviewed on Appeal 

The following issues are presented on appeal: 

Whether Claims 1-9, 11-50, and 56-65 are unpatentable under 35 U.S.C. § 103(a) over 
U.S. Patent Nos. 6,298,445 to Shostack, et al. ("Shostack"), 6,453,345 to Trcka ("Trcka"), and 
6,070,190 to Reps et al. ("Reps"); and 

Whether Claims 51-55 are unpatentable under 35 U.S.C. § 103(a) over Shostack in view 
of Reps. 
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Argument 

The Appellants respectfully submit that this Reply Brief is NOT A SUBSTITUTE for 
Appellants' Brief that was submitted on July 6, 2007. In other words, the Appellants are 
requesting the Board of Appeals to consider both this Reply Brief and their Brief of July 6, 2007 
when rendering their decision on this case. 

Since the Appellants are requesting that the Board of Appeals to consider this Reply Brief 
and the original Brief submitted on July 6, 2007 together, the Appellants have attempted to keep 
this Reply Brief very short in order to help expedite review of this case by the Board of Appeals. 

Examiner's New Ground of Rejection is a Change in Position by the Examiner with 
Respect to the Order/Sequence in which the Board is to Consider the Examiner's 
Combination of Reps and Shostack 

The Appellants note that on page 21, fourth numbered paragraph, in the Examiner's Final 
Office Action of March 20, 2007, the Examiner proposed the combination of Reps and Shostack 
to reject independent Claim 51 where Reps was the primary reference and Shostack was the 
secondary reference. Now, as set forth in the Examiner's new ground of rejection on page 23 of 
the Examiner's Answer of October 9, 2007, the Examiner has changed her position such that her 
primary reference is Shostack and her secondary reference is Reps. 

In light of this mere change in the order of presentation of the references relied on by the 
Examiner, the Appellants believe that their supporting arguments in the Brief of July 6, 2007 are 
still valid since the Brief was prepared irrespective of the order of the presentation of the 
references. That is, the Brief of July 6, 2007 did not turn on or depend on the order in which the 
references were combined. It is the Appellants' position that it does not matter which order or 
sequence that one of ordinary skill in the art reviews these references. The Appellants believe 
that one of ordinary skill in the art would not find the claimed invention as anticipated or obvious 
in view of Shostack, Reps, and Trcka, alone or in combination. 

Accordingly, the Appellants submit that the arguments presented in their Brief of July 6, 
2007 are still valid for all claims, especially for Claims 1-9, 11-50, and 56-65 for which the 
Examiner has maintained her position with respect to her grounds set forth in her Final Office 
Action of March 20, 2007. The Appellants also believe that their arguments for Claims 51-55 in 
the Brief are still valid, but the Appellants have briefly restated them here in this Reply Brief to 
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be in compliance with 37 C.F.R. § 41.37(c)(l)(vii). The Appellants have also responded to a few 
remarks made by the Examiner in her answer that should help the Board of Appeals to identify 
and narrow the issues on this Appeal. 

Independent Claim 5 1 

In Examiner's Answer of October 9, 2007, the Examiner rejected independent Claim 51 
as allegedly being obvious over Shostack in view of Reps. Appellants respectfully traverse this 
rejection. 

In particular, Appellants respectfully submit that the Examiner has not established a 
prima facie case of obviousness with respect to independent Claim 51 because the cited 
documents, such as Shostack and Reps, fail to teach or suggest a method for selecting a computer 
that is strategically located relative to a source of a computer security incident comprising: (1) 
accessing a table comprising computer locations, Internet address ranges associated with the 
computer locations, and computer security threat procedure associated with the computer 
locations, (2) the computer security threat procedure comprising one or more steps for one of 
investigating and responding to one of suspicious computer activity comprising one or more 
attacks received from a network computer that occur prior to a computer security threat and an 
actual computer security threat , (3) the computer locations identifying devices that are able to 
perform computer security threat procedure associated with the computer security step 
information; (4) comparing a computer security threat procedure to be executed and a target 
Internet address with computer locations and Internet address ranges listed in the table; (5) 
determining if a match exists between an Internet address of a computer security incident and the 
Internet address ranges listed in the table; (6) automatically selecting a computer to execute the 
computer security threat procedure based upon the matching step, wherein the computer has a 
location and is capable of interacting with the Internet address of the computer security incident; 
and (7) storing a permanent record comprising the executed computer security threat procedure 
and result information, and corresponding date and time stamps 
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Shostack 

As noted in the Appellants' Brief of July 6, 2007, Shostack is directed to a system for 
automatically providing enhancements to computer security software. (See Abstract). The 
enhancements include updated information regarding security vulnerabilities. The system 
receives an enhancement from a network and integrates the enhancement into the computer 
security software. Before the integration, the system performs a computer check to determine 
the integrity and the authenticity of the enhancement. The computer check can use 
cryptographic techniques such as digital signatures and Pretty Good Privacy (PGP) encryption. 
(See column 2, lines 30-48). 

Reps 

As noted in the Appellants' Brief of July 6, 2007, Reps describes technology that is in the 
field of network system service, and particularly to an end-user based application availability and 
response monitoring and alerting system. The technology described by Reps enables the 
monitoring of availability of response time or other desired performance metrics of an 
application program from the perspective of an end-user utilizing an application program over a 
distributed computing network. (See column 1, lines 24-31.) 

The Proposed Reversal of the Combination: Fails to Teach Independent Claim 5 1 

Irrespective of the order of their combination, one of ordinary skill in the art would 
recognize that the result of that combination does not teach the following as recited in 
independent Claim 5 1 : 

(A) A method for selecting a computer that is strategically located relative to a source of 
a computer security incident comprising: 

(B) accessing a table comprising computer locations, Internet address ranges associated 
with the computer locations, and computer security threat procedure associated with the 
computer locations, 

(C) the computer security threat procedure comprising one or more steps for one of 
investigating and responding to one of suspicious computer activity comprising one or more 
attacks received from a network computer that occur prior to a computer security threat and an 
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actual computer security threat . 

The Appellants believe that one of ordinary skill in the art would find that the proposed 
combination of references does not provide any teaching of computer security threat procedures 
as described and defined in the claims. 

The Examiner admits on page 35, third full paragraph, lines 15-16 that the Reps reference 
does not provide any teaching of computer security threat procedures. Specifically, the 
Examiner states: "Reps do not suggest the violations or computer security threats of a computer 
security system." Given that admission, the Appellants also believe that the Examiner has 
admitted that one of ordinary skill in the art would not attempt the combination which she has 
proposed in her Final Office Action as well as her Examiner's Answer. 

Conclusion 

In view of the arguments presented in this Reply Brief and the full Brief of July 6, 2007, 
Appellants respectfully request that the final rejection in this matter be vacated, and that this 
application be returned to the Examiner with instructions to enter a notice of allowance. 

Respectfully submitted, 

/SPW/ 
Steven P. Wigmore 
Reg. No. 40,447 
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